-
Notifications
You must be signed in to change notification settings - Fork 416
Expand file tree
/
Copy path.bundler-audit.yml
More file actions
115 lines (99 loc) · 4.79 KB
/
Copy path.bundler-audit.yml
File metadata and controls
115 lines (99 loc) · 4.79 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
# Managed ignore list for the dependency audit (dependency:audit rake task).
#
# Only add an advisory id here as a LAST RESORT, after the severity threshold
# (high/critical only) and the 3.1+ scoping have already been applied and the
# advisory is still genuinely unavoidable (e.g. a high/critical CVE in an old
# compatibility gem with no fixed version available for that Ruby).
#
# Each entry MUST be documented with:
# - the advisory id (CVE or GHSA)
# - the gem and why it cannot be upgraded
#
# Reviewed on a regular cadence; remove entries once the gem can be upgraded.
ignore: []
# Gem+version-scoped ignore list, checked in addition to `ignore` above.
# Unlike `ignore`, each entry only suppresses findings for that exact
# gem+version pair, so bumping the gem makes the finding reappear instead
# of staying silently hidden.
#
# Each entry MUST be documented with:
# - the gem and the exact pinned version
# - why it cannot be upgraded (what pins it, and whether a fix exists upstream)
#
# Reviewed on a regular cadence; remove entries once the gem can be upgraded.
ignore_gem_versions:
- gem: rack
version: 1.6.13
reason: "Pinned by devise_min/rack_1 Gemfiles' old Rails/Devise/rack-1.x compatibility constraints"
- gem: actionpack
version: 4.2.11.3
reason: "Pinned by devise_min Gemfiles' old Rails version floor"
- gem: activesupport
version: 4.2.11.3
reason: "Pinned by devise_min Gemfiles' old Rails version floor"
- gem: devise
version: 3.2.1
reason: "devise_min Gemfiles intentionally pin the minimum supported devise version; no fixed 3.2.x release exists"
- gem: faraday
version: 0.17.6
reason: "Pinned below 1.0 by presto-client's dependency on faraday_middleware ~> 0.12.2; no newer presto-client release relaxes this"
- gem: sprockets
version: 1.0.2
reason: "Pinned < 4 by the rails8_trilogy Gemfile itself"
- gem: actionpack
version: 6.1.7.10
reason: "Ceiling of rails ~> 6.1.0 constraint in graphql/rails61_*/rails_old_redis Gemfiles; no newer 6.1.x release exists"
- gem: actionview
version: 6.1.7.10
reason: "Ceiling of rails ~> 6.1.0 constraint in graphql/rails61_*/rails_old_redis Gemfiles; no newer 6.1.x release exists"
- gem: activerecord
version: 6.1.7.10
reason: "Ceiling of rails ~> 6.1.0 constraint in graphql/rails61_*/rails_old_redis Gemfiles; no newer 6.1.x release exists"
- gem: activestorage
version: 6.1.7.10
reason: "Ceiling of rails ~> 6.1.0 constraint in graphql/rails61_*/rails_old_redis Gemfiles; no newer 6.1.x release exists"
- gem: activesupport
version: 6.1.7.10
reason: "Ceiling of rails ~> 6.1.0 constraint in graphql/rails61_*/rails_old_redis Gemfiles; no newer 6.1.x release exists"
- gem: actionview
version: 7.0.10
reason: "Ceiling of rails ~> 7.0.0 constraint in rails7 Gemfiles; no newer 7.0.x release exists"
- gem: activerecord
version: 7.0.10
reason: "Ceiling of rails ~> 7.0.0 constraint in rails7/relational_db Gemfiles; no newer 7.0.x release exists"
- gem: activestorage
version: 7.0.10
reason: "Ceiling of rails ~> 7.0.0 constraint in rails7 Gemfiles; no newer 7.0.x release exists"
- gem: activesupport
version: 7.0.10
reason: "Ceiling of rails ~> 7.0.0 constraint in rails7/relational_db Gemfiles; no newer 7.0.x release exists"
- gem: actionview
version: 7.1.6
reason: "Ceiling of rails ~> 7.1.0 constraint in rails71 Gemfiles; no newer 7.1.x release exists"
- gem: activestorage
version: 7.1.6
reason: "Ceiling of rails ~> 7.1.0 constraint in rails71 Gemfiles; no newer 7.1.x release exists"
- gem: activesupport
version: 7.1.6
reason: "Ceiling of rails ~> 7.1.0 constraint in rails71 Gemfiles; no newer 7.1.x release exists"
- gem: actionview
version: 4.2.11.3
reason: "Pinned by devise_min Gemfiles' old Rails version floor (intentional min-version test coverage)"
- gem: sinatra
version: 2.2.4
reason: "Ceiling of sinatra ~> 2 constraint in sinatra_2 Gemfiles; no newer 2.x release exists"
- gem: sinatra
version: 3.2.0
reason: "Ceiling of sinatra ~> 3 constraint in sinatra_3 Gemfiles; also the highest sinatra rails_app's rack ~> 2 pin allows (sinatra 4.x requires rack 3)"
- gem: sqlite3
version: 1.7.3
reason: "Ceiling of the resolved sqlite3 ~> 1.4 constraint in relational_db Gemfiles (ruby 3.4/4.0); no newer 1.x release exists"
- gem: nokogiri
version: 1.18.10
reason: "Latest nokogiri installable on Ruby 3.1; 1.19.0+ requires Ruby >= 3.2"
- gem: sqlite3
version: 2.8.1
reason: "Latest sqlite3 installable on Ruby 3.1; 2.9.0+ requires Ruby >= 3.2"
- gem: rack-contrib
version: 1.8.0
reason: "rack-contrib >= 2.0.0 (fixed for CVE-2024-35231) requires Rack::MediaType, unavailable before Rack 2.0; rack_1 appraisal intentionally tests Rack 1.x"